CIA exam syllabus, schedule, results and fees

Foundations: authority and the purpose of the work

This domain covers the mandate, charter, independence and types of audit service. Read a scenario by identifying who authorizes the work, who makes operational decisions and what assurance or advice is requested.

For example, helping a procurement team assess proposed approval rules differs from becoming the person who approves purchases. The second role changes the auditor’s responsibility. In your notes, describe that change rather than labeling both activities “helping management.”

Ethics: judgment when responsibilities conflict

Coverage includes integrity, objectivity, competence, professional care and confidentiality. Knowing their definitions is a starting point; the practical question is how an auditor responds when a relationship, incentive or information request creates a problem.

Try changing one fact in a practice scenario: the auditor previously ran the process, or a manager requests confidential findings. Explain why the new fact matters before choosing a response. This exposes gaps hidden by a memorized answer.

Governance and risk: connect controls to objectives

This domain connects oversight, organizational culture, risk assessment and internal controls. Distinguish the risk itself from the action taken to address it, then consider control design and actual operation.

A purchase approval rule might be well designed but routinely bypassed. Conversely, a consistently performed review might check the wrong risk. Describe both possibilities in plain language before trying to classify a control.

Fraud: recognize exposure without assuming guilt

Fraud coverage includes risk factors, schemes, warning signs, prevention and detection. A suspicious pattern calls for evaluation; it does not by itself establish the cause or identify a guilty person.

Repeated payments just below an approval threshold are a useful teaching example. List the additional records you would need to understand them. Compare a legitimate recurring purchase with deliberate splitting instead of jumping from the pattern to an accusation.

Planning: build a defensible path from risk to tests

Planning covers objectives, scope, criteria, risk assessment, procedures and resources. It also brings business, financial and technology risks into engagement design. A work program should show how the planned evidence will answer the audit objective.

Suppose the risk is unauthorized supplier creation. Checking invoice arithmetic may produce accurate workpapers yet leave the main risk unanswered. Start by asking which permissions and approval records would show whether supplier setup is controlled.

Information and analysis: decide what the evidence supports

Coverage includes collecting and evaluating information, analytical techniques, sampling, workpapers and conclusions. Consider relevance, reliability and sufficiency together. A large amount of information is not automatically strong evidence.

For an overdue-payment analysis, first examine whether the extract contains all relevant invoices and whether its date fields mean what you assume. A polished chart cannot repair an incomplete population. Record the limitation before interpreting the apparent trend.

Supervision and communication: keep the engagement on course

This domain concerns oversight of assignments, review of work and communication with appropriate stakeholders throughout the engagement. Supervision begins during planning rather than only when the draft report is finished.

If testing reveals an unexpected system outside the agreed scope, simply adding more procedures can create an unreviewed change. Explain what the supervisor needs to know and how the discovery affects the objective, resources and communication plan.

Operations: manage the audit function’s capacity

Operations covers methodologies, resources, strategy and stakeholder communication. The focus extends beyond completing one assignment to maintaining a function capable of delivering its responsibilities.

An audit team might have enough total staff hours but no specialist able to assess a new system. Treating those hours as interchangeable hides the capability gap. A useful practice answer explains both the resource issue and its consequence for coverage.

The audit plan: choose coverage across the organization

This domain covers the audit universe, risk-based prioritization, changes to the plan and coordination with other assurance providers. It asks which engagements belong in the portfolio and why.

A new distribution business may change priorities even if last year’s audit calendar ran smoothly. Identify what changed in the risk picture before deciding which planned work to retain, defer or revise.

Quality: evaluate the function itself

Quality coverage includes internal and external assessments, improvement, nonconformance and performance measures. Distinguish evaluating the audit function from evaluating the business process being audited.

Completing every scheduled audit is a productivity observation. By itself it does not tell you whether the evidence was persuasive or important risks were covered. Compare a volume measure with a measure of work quality when reviewing this domain.

Results and monitoring: carry findings through to action

This domain covers final communications, recommendations and action plans, follow-up and escalation. Connect the finding to its cause and evaluate whether the proposed response addresses it.

Management may report that a new approval procedure was issued. That establishes a change to the instructions, but you still need evidence about subsequent transactions to assess operation. Explain what remains unverified before treating an issue as resolved.

Convert a topic into something you can demonstrate

“I studied evidence” is difficult to verify. “I can explain why this spreadsheet does not support a completeness conclusion” gives you a task to test. Write that task next to the lesson or question set you used. If you can repeat a definition but cannot use it when a fact changes, keep the outcome open in your checklist.

Read the verb in context. Describing a process calls for an explanation; evaluating a choice calls for reasons tied to the facts. Do not assume every outcome can be covered by memorizing a glossary or by counting completed questions.

Keep the decision with the note

When reusing a note, add the actor, stage and output expected. A note about an engagement work program will not fully answer a question about the organization-wide audit plan. Likewise, collecting evidence during fieldwork differs from checking whether an agreed corrective action operates after reporting. Reusing the underlying principle is useful; reusing an answer without checking the task is not.

Use weights and your own gaps together

Start by checking that every domain has material assigned to it. Then use fresh questions and explanations to identify weak outcomes. A domain’s percentage helps you judge its relative size, but it does not measure your current understanding or prescribe the same study allocation for everyone.

For example, a learner with strong planning knowledge but weak evidence evaluation may temporarily spend more repair time on the latter. Retain some mixed practice so the stronger area stays active, and reassess after unfamiliar questions. This is an adjustable study method, not an official readiness formula.

Check a course before treating its outline as complete

Choose several specific outcomes from the official PDF and locate the corresponding instruction, application example and explanation in your materials. A matching chapter title is only the first check. If an outcome is missing, record the gap and obtain suitable instruction rather than assuming a large question count covers it.

Keep edition and language alongside the checklist. When a syllabus changes, a completed checkbox from an older course does not show that the current outcome was taught. The separate syllabus-changes guide explains how to reconcile older materials.